← CVE Radar
CVE-2026-61857ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.
6.3 MEDIUMEPSS 0.26%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.3 | MEDIUM | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.7 | LOW | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Details
- CVE ID
- CVE-2026-61857
- Status
- Analyzed
- Assigner (CNA)
- VulnCheck
- Published
- Jul 11, 2026
- Last modified
- 2026-10-29 21:17 UTC
- Weaknesses
- CWE-252 · Unchecked Return Value
Affected Products
As published by the CNA in the CVE record.
ImageMagickImageMagick1 version range
- 7.0.0 before 7.1.2-26
ImageMagickImageMagick1 version range
- before 6.9.13-51